Istio Ambient Mode — Without Sidecar container approach

Imagine you just stumbled upon a revolutionary new stone in the service mesh world — Istio’s Ambient Mode. It’s a game-changer, a shift that takes away the heavy, resource-hungry sidecars, replacing them with something lighter, faster, and simpler. What’s at the heart of this new approach? Meet ztunnel, a small but mighty component that’s rewriting the rules of how services talk to each other securely in Kubernetes.

The Magic of Ambient Mode: A New Perspective

Traditionally, Istio (like most service meshes) used sidecar proxies. Each pod in your Kubernetes cluster would have its own sidecar — a separate container sitting next to the application, handling network traffic, security (mutual TLS or mTLS), and observability. Sounds cool, right? But when your cluster grows, thousands of sidecars start hogging resources, adding operational complexity, and making you wish for a lighter, simpler solution.

Here’s where Ambient Mode enters the scene, like a breath of fresh air. It brings a completely new approach: no more sidecars! Instead of injecting proxies into every single pod, Ambient Mode pulls them out and centralizes their functionality. No more fiddling with per-pod configurations. No more worrying about sidecar performance issues. Instead, you get a ztunnel on every node that takes over the job.

What Exactly is ztunnel?

ztunnel (short for zero-trust tunnel) is the heart and soul of Ambient Mode. It’s like the friendly neighborhood guardian, quietly sitting on each node and handling all the traffic between your services. Unlike the sidecar model, where every pod had its own proxy, ztunnel is a single component per node, and it does the job for all the workloads on that node. Think of it as the proxy that serves the whole street instead of just one house.

But it’s not just about simplifying things — ztunnel adds a bunch of benefits:

1. No more sidecars: That’s right! Ambient Mode ditches sidecar proxies, meaning your application pods run cleanly without additional containers.
2. Node-level efficiency: Since ztunnel runs at the node level, it reduces CPU and memory consumption, making your clusters more efficient and less resource-hungry.
3. Security without the headache: Just like in the old sidecar model, ztunnel enforces mTLS (mutual TLS), ensuring secure, encrypted communication between your services. Your services stay safe, and you get to enjoy simpler operations.
4. Transparent to your apps: The best part? Your applications don’t need to know anything about the mesh. They just keep doing their thing, while ztunnel quietly handles all the magic in the background.

How Does ztunnel Work?

Let’s break down how ztunnel fits into this new Ambient Mode:

• Capturing traffic: All inbound and outbound traffic from your application pods is routed through ztunnel. It acts as the gatekeeper, intercepting and securing the traffic.
• Securing with mTLS: ztunnel makes sure every connection between your services is encrypted using mTLS, so only authorized services can talk to each other. It’s like a bouncer at the door, checking IDs before letting anyone in.
• Node-level service: Instead of running multiple proxies (one per pod), ztunnel serves all workloads on a node. That means fewer proxies to manage and monitor, resulting in a leaner and meaner cluster.
• Collaboration with Waypoint proxies: For advanced routing features like retries or traffic splitting, ztunnel hands off some work to Waypoint proxies, which act as the smarter traffic controllers. ztunnel handles the heavy lifting at the transport layer (L4), and Waypoint takes over for application-layer tasks (L7).

Why Ambient Mode is a Big Deal

So, why is this discovery so exciting? Ambient Mode doesn’t just tweak how Istio works — it redefines it. By cutting out the need for sidecars, it simplifies your service mesh, reduces resource usage, and makes Istio much easier to manage at scale. You no longer have to worry about the performance hit from thousands of sidecar proxies or the complexity of maintaining them.

Here’s what makes it revolutionary:

• Resource efficiency: Running ztunnel on each node instead of deploying sidecars to every pod frees up CPU and memory, making your cluster more cost-effective.
• Operational simplicity: Without sidecars, managing and troubleshooting the mesh becomes much easier. Everything is centralized, which means less configuration and fewer moving parts to worry about.
• Security first: ztunnel maintains Istio’s strong security features like mTLS and workload identity, keeping your mesh secure while reducing complexity.

Ambient Mode with ztunnel is like discovering a hidden gem in the Istio ecosystem. It takes everything we love about service meshes — security, observability, traffic management — and strips away the complexity of sidecars. You get a faster, leaner, and more manageable service mesh that’s ready to scale effortlessly.

With ztunnel in charge, you can focus on building and scaling your apps without worrying about the overhead of proxies slowing you down. So, if you’re looking for a way to simplify your Kubernetes operations and make your service mesh more efficient, Ambient Mode is the future you’ve been waiting for.

Checkout more about istio ambient mode on istio documention

Go ahead, try it out — your Kubernetes clusters will thank you 😃 and follow me on linkedin 😉